What is the flow impact of updating the Cloud Services plugin on existing traffic flows in Prisma Access?

The Prisma Access architecture is designed for high availability and seamless operations. Updating the Cloud Services plugin on Panorama is a management plane activity. This update enables new features and capabilities within Panorama for configuring Prisma Access. The process does not impact the data plane where user traffic flows are actively being processed. The upgrade is transparent to end-users, and their existing sessions are not terminated or subjected to added latency, ensuring service continuity.

A. They will experience latency during the plugin upgrade process. This is incorrect. The upgrade process is engineered to be non-disruptive to the data plane, so noticeable latency is not an expected outcome for existing traffic flows.
B. They will automatically terminate when the upgrade begins. This is incorrect. Terminating active user sessions would be a service-impacting event, which the seamless upgrade architecture of Prisma Access is specifically designed to prevent.
D. They will be unaffected only if Panorama is deployed in high availability (HA) mode. This is incorrect. While Panorama HA is critical for management plane resiliency, the non-disruptive nature of the upgrade on traffic flows is an inherent feature of the Prisma Access cloud data plane, independent of the Panorama deployment model.

1. Palo Alto Networks - Prisma Access Administrator’s Guide: In the section "Upgrade Prisma Access," the documentation states, "Prisma Access upgrades are designed to be seamless and have no impact on your users' traffic." This principle applies to the various components, including the plugin, which facilitates the management of the service. The separation of the management plane (Panorama) and data plane (Prisma Access cloud) ensures that management changes do not disrupt live traffic. (Reference: Prisma Access Administrator’s Guide, "Upgrade Prisma Access" section).

2. Palo Alto Networks - Cloud Services Plugin Install and Upgrade Guide: The process of upgrading the plugin involves downloading and installing it on Panorama, followed by a commit. These actions occur on the management plane. The documentation details these steps without mentioning any required downtime or impact on user traffic, reinforcing the non-disruptive nature of the operation. (Reference: Cloud Services Plugin documentation, "Upgrade the Cloud Services Plugin" section).